CVE-2016-2048 json
Django Access Restrictions Bypass
published 2016-02-08 10 y ago modified 2026-06-17 4 mo ago also GHSA-46x4-9jmv-jc8p , PYSEC-2016-14 , EUVD-2016-0003
- cvss
- 5.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 0
- none known
Summary
Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.
Patch / fix
- pypi django 1.9.2
- python-django Debian 14, Debian 13, Debian 12 1.9.2-1
debian advisories DEBIAN-CVE-2016-2048
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-2048 updated cvss 3.5
python-django: user with "change" but not "add" permission can create objects for ModelAdmin
-
Red Hat Ceph Storage 1.2 Django Red Hat Ceph Storage 1.3 Django Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) python-django Red Hat Enterprise Linux OpenStack Platform 6 (Juno) python-django Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) python-django, python-django-bash-completion Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools python-django, python-django-bash-completionnot affected: vulnerable code not present
+3 more productsfewer
Red Hat OpenStack Platform 8 (Liberty) python-django, python-django-bash-completion Red Hat OpenStack Platform 8 (Liberty) Operational Tools python-django, python-django-bash-completion Red Hat Subscription Asset Manager Django
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.53% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 5.5 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django | >=1.9, <1.9.2 |
1.9.2 |
Classification
- Weakness
-
- CWE-284 Improper Access Control
- Technology feeds
References
-
github.com
/django/django/commit/adbca5e4db42542575734b8e5d26961c8ada7265
web
-
djangoproject.com
/weblog/2016/feb/01/releases-192-and-189/
article
-
securityfocus.com
/bid/82329
vdb-entry, web
-
securitytracker.com
/id/1034894
vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2016-2048
advisory
-
github.com
/django/django
package
-
github.com
/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-14.yaml
web
-
web.archive.org
/web/20210123075529/http://www.securityfocus.com/bid/82329
web
-
web.archive.org
/web/20211204051406/http://www.securitytracker.com/id/1034894
web
-
djangoproject.com
/weblog/2016/feb/01/releases-192-and-189
web
-
github.com
/advisories/GHSA-46x4-9jmv-jc8p
advisory
Sources
- CVE List CVE-2016-2048
- GitHub Advisory GHSA-46x4-9jmv-jc8p
- NVD CVE-2016-2048
- OSV PYSEC-2016-14
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.